diff --git a/js/apps/system/_admin/aardvark/APP/foxxes.js b/js/apps/system/_admin/aardvark/APP/foxxes.js index c8b8dc2ae8..d6dd54f704 100644 --- a/js/apps/system/_admin/aardvark/APP/foxxes.js +++ b/js/apps/system/_admin/aardvark/APP/foxxes.js @@ -211,11 +211,12 @@ res.transformations = [ "base64decode" ]; var mount = validateMount(req); var app = FoxxManager.lookupApp(mount); - if (app.hasOwnProperty("thumbnail")) { + if (app.hasOwnProperty("thumbnail") && app.thumbnail !== null) { res.body = app.thumbnail; } else { res.body = defaultThumb; } + // evil mimetype detection attempt... var start = require("internal").base64Decode(res.body.substr(0, 8)); if (start.indexOf("PNG") !== -1) {